CVE-2020-4395: Insufficient Session Expiration

IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358...

DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Session Expiration - Previously issued email change tokens do not expire upon issuing a new email change token

The email verification code was not expired when a new one was generated. It was fixed. Summary When a user changes their email, they can receive a verification code in the changed email. This verification code will be used when changing your email. but, drive2.ru can reuse a corrupted verificati...

CVE-2020-4780: Insufficient Session Expiration

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158...

TikTok: Lack of session expiration after password reset on TikTok Careers Portal

A lack of session expiration following a password reset on the TikTok Careers Portal does not automatically log out a user on another device/browser. We thank @gnux for reporting this to our team and confirming the resolution...

CVE-2019-19199

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout...

CVE-2019-19199

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout...

Session fixation

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout...

CVE-2019-19199

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout...

CVE-2019-19199

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration: tokens are not invalidated on logout. Documented as CVE-2019-19199 (CWE-613). SYSS advisory SYSS-2019-049 (PacketStorm) lists the vulnerability type and notes a fix with Solution Date 2020-06-09 and Public Disclosure 2020-09...

CVE-2019-19199: Insufficient Session Expiration

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout...

U.S. Dept Of Defense: Insufficient Session Expiration on Adobe Connect | https://█████████

Description: Due to lack of password protection and Insufficient Session Expiration I am able to brute force Adobe Connect meeting rooms. Many of the meeting rooms have chat history and files uploaded. Some of the chat history and files contains personal identifiable information. Walkthrough...

MailDepot 2032 SP2 Session Expiration

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2019-049 Product: MailDepot Manufacturer: REDDOXX GmbH Affected Versions: 2032 SP2 2.2.1242 Tested Versions: 2032 SP2 2.2.1242 Vulnerability Type: Insufficient Session Expiration CWE-613 Risk Level: Low Solution Status: Fixed...

PT-2020-10086

Name of the Vulnerable Software and Affected Versions REDDOXX MailDepot version 2032 SP2 2.2.1242 Description The issue is related to insufficient session expiration, where tokens are not invalidated upon logout. This can potentially allow unauthorized access to user sessions. Recommendations For...

CVE-2020-15774: Insufficient Session Expiration

An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user...

CVE-2020-13307: Insufficient Session Expiration

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

CVE-2020-13302: Insufficient Session Expiration

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password...

CVE-2020-13299: Insufficient Session Expiration

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session...

CVE-2020-13305: Insufficient Session Expiration

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project...

Peplink Balance routers SQLi

Firmware versions up to 7.0.0-build1904 of Peplink Balance routers are affected by an unauthenticated SQL injection vulnerability in the bauth cookie, successful exploitation of the vulnerability allows an attacker to retrieve the cookies of authenticated users, bypassing the web portal...

Tenable Nessus < 8.11.1 Session Expiration (TNS-2020-06)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.11.1. Nessus 8.11.0 and earlier were found to be maintaining sessions longer than the permitted period in certain scenarios. The lack of proper session expiration allows attackers with...